139863 matches found
GHSA-4VPF-W7QV-5H3Q MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs
Unvalidated notetype Parameter in mcissueupdate SOAP Endpoint Allows creation of TIMETRACKING and REMINDER Notes. The SOAP path passes the user-supplied notetype integer directly to bugnoteadd without validating that the user is authorized to create that type of note. If the user's access level i...
TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development
Cybersecurity researchers have disclosed details of a previously unreported Internet-of-Things IoT botnet framework dubbed TuxBot v3 Evolution that shows signs of being developed with assistance from a large language model LLM, albeit with not so successful results. "While the AI complied with...
GHSA-3V2J-6FW9-F57C MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters
Impact Users below reportissuesforunreleasedversionsthreshold can assign unreleased product versions. Patches - https://github.com/mantisbt/mantisbt/commit/17072d4c322c85f7135ebec3417a6d90b525d12f Workarounds None Resources - https://mantisbt.org/bugs/view.php?id=37065 Credits MantisBT thanks...
MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters
Impact Users below reportissuesforunreleasedversionsthreshold can assign unreleased product versions. Patches - https://github.com/mantisbt/mantisbt/commit/17072d4c322c85f7135ebec3417a6d90b525d12f Workarounds None Resources - https://mantisbt.org/bugs/view.php?id=37065 Credits MantisBT thanks...
Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4
Summary Koel's outbound-URL guard App\Helpers\Network::isPublicHost classifies an IP as "public" using PHP's filtervar$ip, FILTERVALIDATEIP, FILTERFLAGNOPRIVRANGE | FILTERFLAGNORESRANGE. That flag set does not recognise IPv6 transition-address forms that embed a private/loopback/link-local IPv4:...
GHSA-RJG7-R26H-CFP2 Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4
Summary Koel's outbound-URL guard App\Helpers\Network::isPublicHost classifies an IP as "public" using PHP's filtervar$ip, FILTERVALIDATEIP, FILTERFLAGNOPRIVRANGE | FILTERFLAGNORESRANGE. That flag set does not recognise IPv6 transition-address forms that embed a private/loopback/link-local IPv4:...
Security Bulletin: The following vulnerability that can affect IBM Storage Scale System and TPM is now fixed in Storage Scale System 6.2.3.6 and 7.0.1.0 or higher
Summary The following vulnerability, which can affect IBM Storage Scale System and TPM could provide weaker-than-expected security, is now fixed in Storage Scale System 6.2.3.6 and 7.0.1.0 or higher CVE-2025-2884 Vulnerability Details CVEID:CVE-2025-2884 DESCRIPTION: TCG TPM2.0 Reference...
GHSA-WJHR-76VG-2HVC garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store
Insecure Permission Assignment for Garmin OAuth Token Store Summary garminconnect ≤ 0.3.4 wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask 022 the token file garmintokens.json was created world-readable 0o644. The file contains the DI...
garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store
Insecure Permission Assignment for Garmin OAuth Token Store Summary garminconnect ≤ 0.3.4 wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask 022 the token file garmintokens.json was created world-readable 0o644. The file contains the DI...
MantisBT: REST API unauthorized Issue status change
A MantisBT user having $gupdatebugthreshold UPDATER by default can change an Issue's Status via REST and SOAP API, even if the $gsetstatusthreshold config is set to a higher level DEVELOPER by default. Impact Unauthorized change in Issue workflow. Patches...
GHSA-M7PH-9558-MRX3 MantisBT: REST API unauthorized Issue status change
A MantisBT user having $gupdatebugthreshold UPDATER by default can change an Issue's Status via REST and SOAP API, even if the $gsetstatusthreshold config is set to a higher level DEVELOPER by default. Impact Unauthorized change in Issue workflow. Patches...
MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php
MantisBT 2.28.3 and earlier contains a remote code execution vulnerability in the admin "Manage Configuration" feature admconfigset.php. When setting a configuration value with a non-string type integer, float, complex, the value is passed through ConfigParser - Tokenizer, which calls eval with a...
GHSA-V84X-QVHG-F36R MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php
MantisBT 2.28.3 and earlier contains a remote code execution vulnerability in the admin "Manage Configuration" feature admconfigset.php. When setting a configuration value with a non-string type integer, float, complex, the value is passed through ConfigParser - Tokenizer, which calls eval with a...
Exploit for Server-Side Request Forgery in Sonicwall Sma6210_Firmware
🚨 CVE-2026-15409 Critical Unauthenticated SSRF in SonicWall...
MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
MantisBT 2.28.3 and earlier contains a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing the target's password. The vulnerability ...
GHSA-C2XG-QJQW-2V98 MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
MantisBT 2.28.3 and earlier contains a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing the target's password. The vulnerability ...
bug-bounty-toolkit
Bug Bounty Toolkit Automated reconnaissance-to-triage pipelin...
Security Bulletin: IBM Storage Protect Client is vulnerable to Heap-Based Buffer Overflow (CVE-2026-13473)
Summary IBM Storage Protect Client is vulnerable to Heap-Based Buffer Overflow due to unchecked string copy operations. Vulnerability Details CVEID:CVE-2026-13473 DESCRIPTION: IBM Storage Protect is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attacker...
K000162101: NGINX Plus ngx_stream_mqtt_filter_module vulnerability CVE-2026-60065
Security Advisory Description When NGINX Plus is configured to use the Message Queuing Telemetry Transport MQTT filter module ngxstreammqttfiltermodule, unauthenticated attackers can send requests with conditions beyond the attacker's control to cause a heap buffer over-read in the NGINX worker...
K000162097: NGINX map directive and regex matching vulnerability CVE-2026-42533
Security Advisory Description A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by...